There’s an interesting section in the Wikipedia entry for Acceptable Use Policies called “Is an AUP the best approach?” here.

Here’s an excerpt:

In a well respected essay on the topic of AUP documents, Dave Kinnaman, raises the issue as to whether writing and enforcing AUP documents is the right way to approach the governance as to how Internet connections are to be used at school, at work or in people’s own free time.

In this essay he raises the question with the perspective that the Internet is no different from anywhere we use 3rd party property. Do we write a “users guide” to go to a school, or do we write a user’s guide to shopping in the shopping mall? No, and why we do not is because we are educating young adults to behave in certain ways when at the shopping mall, or at school, or in the library.

Businesses should have a good AUP document that, according to visionGateway, a business implementing secure networks for businesses, should cover the business legally in any situation that the business might need to take to protect its interests. Also privacy and individual rights need to be addressed.

So the question is, do we teach our students at school and encourage our employees at work to maintain self-control, or do we explicitly outline acceptable use policies? Possibly both AUPs and self-control can be encouraged and when used together it could bring the best outcome for both organisations and individuals.

I think it’s an interesting question, but in the end your auditors are going to ask for your AUP. If you don’t have one they’ll probably tell you to get one.

What do you think?

I really like the easy-to-read-and-understand customer data security policy from ING Direct here.

I wish more companies wrote such simple and clear policies.

Here’s an exerpt:

We take every reasonable precaution to protect your information. When you submit information to us through our web site, your information is protected both on-line and off-line. All data transferred to/from the ING DIRECT internal network, from/to an external entity, is encrypted to industry standards (128 bit encryption). Please keep in mind that messages you send to us by Internet e-mail may not be secure. Do not send us any confidential or personal information by Internet e-mail. We maintain appropriate physical, electronic and procedural safeguards to ensure the security, integrity and privacy of your personal information within our company. Only those employees who require your personal information to perform a specific job are granted access to your personally identifiable financial information. Furthermore, all employees are kept up-to-date on our security and privacy practices. If you have any questions about the security of your information at ING DIRECT, you may contact us at 1-800-ING-DIRECT (1-800-464-3473), or at the following address: ING DIRECT, 1 South Orange Street, Wilmington, Delaware 19801.

I found a great presentation called “Best Practices in Corporate Privacy & Information Security” by Donald Cohn at the infolaw.org site here.

Donald covers lots of security policies starting on slide 22.

These are the policies he lists under Information Classification & Protection:

• Information Classification & Protection
  • Information Classification
  • Information Retention
  • Anti-Virus Software
  • Application/Software Development
  • Information Disposal
  • Apply “Right to Know” Principle
  • Back-ups
  • Encryption
  • Fax Transmissions
  • Use of Copiers & Area Printers
  • Company Developed Software Ownership
  • Vulnerability Migration
  • Equipment Inventory

Check it out!

If you’re planning on deploying Windows Vista, make sure you follow the Windows Vista Security Guide available from Microsoft Technet here.

This is a description of the hardening guide:

This guide focuses on how to help create and maintain a secure environment for desktop and laptop computers that run Windows Vista. The guide explains the different stages of how to secure two different environments, and what each security setting addresses for the desktop and laptop computers deployed in either one. The guide provides prescriptive information and security recommendations.

Here are the chapters:

Chapter 1: Implementing the Security Baseline
Chapter 2: Defend Against Malware
Chapter 3: Protect Sensitive Data
Chapter 4: Application Compatibility
Chapter 5: Specialized Security – Limited Functionality
Appendix A: Security Group Policy Settings

Don’t install Vista without it!

The Laptop Security Blog over at www.absolute.com has an interesting post about how the Auditor General of Canada says government agencies aren’t upholding the Government Security Policy (GSP).

In particular, the Auditor General said that the security policy doesn’t include a disaster recovery plan.

Even if you work in a company you can expect that auditors are going to look for a disaster recovery policy and disaster recovery plan in your corporate security policy.

Here’s a fun security training video that could be useful to explain the value of security policies and security concepts like defense in depth:

I like how it incorporates Second Life as a training tool. 

The educause.edu site has a chapter from the book Computer and Network Security in Higher Education here.

It does a good job of describing how university security policies should be written.

Here’s an excerpt:

If the goal of institutional policies is to direct individual behavior and guide institutional decisions, then the effectiveness of formal policy statements will depend on their readability and usefulness. Many colleges and universities suffer from the lack of a common and consistent approach or format for writing organizational policies. Policy development is often confused and sometimes derailed because of the misunderstanding and misuse of terms with important meanings to a professional policy administrator, legal counsel, and others.

You can download an archive copy of the chapter here.

This is a great site to find a ton of actual security policies and procedures used by universities.

Here’s a sample of some of the university policies available:

• Data Handling and Storage Policy (Adams State College)
• Secure Handling of Social Security Numbers (Northwestern University)
• Data Access, Security, Classification and Handling (Purdue University)
• The Payment Card Industry (PCI) Data Security Standard (Duke University)
• Information Access & Protection Standard (Rochester Institute of Tecnology)
• Data Classification Security Policy (George Washington University)

Lots of helpful security policy templates for you to use. Check it out!

The IT Security group at the California Department of Techonology Services (DTS) have a security incident response presentation here that describes their incident response plan.

This presentation includes a couple of scenarios where they demonstrate how to implement the Security Incident Lifecycle:

• Security Incident Identification
• Security Incident Triage
• Security Incident Response & Resolution
• Security Incident Communication (concurrent)
• Post Security Incident Documentation

Great info!

Joel Weise and Charles R. Martin from Sun wrote an excellent Data Security Policy guide which you can download here.

This is a great reference to follow when developing any data security policy.

Here’s an excerpt:

The purpose of this document is to define the Data Security Policy. Data is considered a primary asset and as such must be protected in a manner commensurate to its value. Data security is necessary in today’s environment because data processing represents a concentration of valuable assets in the form of information, equipment, and personnel. Dependence on information systems creates a unique vulnerability for our organization.

Security and privacy must focus on controlling unauthorized access to data. Security compromises or privacy violations could jeopardize our ability to provide service; lose revenue through fraud or destruction of proprietary or confidential data; violate business contracts, trade secrets, and customer privacy; or reduce credibility and reputation with its customers, shareholders and partners. This policy therefore discusses:

• Data content
• Data classification
• Data ownership
• Data security

The main objective of this policy is to ensure that data is protected in all of its forms, on all media, during all phases of its life cycle, from unauthorized or inappropriate access, use, modification, disclosure, or destruction. This policy applies to all of our and all customer data assets that exist, in any of our processing environments. The processing environment is considered to be, collectively, all applications, systems, and networks that we own or operate or that are operated by our agents.

Very helpful! Check it out!